fix(ci): read review instructions from the base ref

[sbaerlocher]

Summary

• The AI review workflow read REVIEW.md, AGENTS.md and CLAUDE.md from the PR's own checkout, so a PR touching those files rewrote the instructions of the agent reviewing it — while that agent holds gh pr review --approve. Not exploitable externally (fork PRs are skipped on line 62), but it bypassed the review gate for any collaborator.
• A second sparse actions/checkout now fetches these files from github.base_ref into .review-base/, and the prompt reads only from there. The existing PR checkout is untouched: the agent still reviews the PR's code, just not its rules.
• Bash(gh pr review:*) is deliberately left in --allowedTools. With the rules coming from the base ref the vector is closed; conditional diff analysis in a security-critical file would be redundancy without added protection.

Rollout

The merge alone does not reach consumers: all seven pin ai-claude-review.yml@2026-06-18, not @main. A new date tag on main plus a Renovate bump is required. (templates/workflows/pull-request.yml:61 references @main but is obsolete and not the active integration.)

Test plan

• yamllint -c templates/.yamllint.yml — only the pre-existing 515-char --allowedTools line is flagged, identical to the state on main; no new findings.
• workflow_call signature unchanged — verified against the diff.
• git diff --name-only origin/main shows exactly the two intended files.
• Sparse-checkout tolerates missing files (exit 0); REVIEW.md does not exist in this repo and is skipped without error.
• The review run on this PR is the first live exercise of the change — the agent reviewing it reads its rules from .review-base/.

[claude]

This changelog entry documents a fix that is not present in the PR. The net diff of this PR against main is only this CHANGELOG entry — the workflow file .github/workflows/ai-claude-review.yml at the head SHA is byte-for-byte identical to main.

The PR's own commit history explains why: the fix was made in 6ef5c2a ("fix(ci): read review instructions from the base ref") and then reverted in 2b957b1 ("ci: temporarily restore main workflow to isolate regression"), with a debug commit (0b4eade) in between. So merging as-is would:

1. Add a CHANGELOG entry claiming the security fix (second sparse actions/checkout into .review-base/) is shipped, while the actual ai-claude-review.yml still reads REVIEW.md/AGENTS.md/CLAUDE.md from the PR checkout — the vulnerability described here would remain unfixed while the changelog asserts it is fixed.
2. Leave temporary/WIP commits ("add temporary workspace debug step", "temporarily restore main workflow") in the merged history.

Please re-apply the actual workflow change (or drop the CHANGELOG entry) so the code matches what this entry describes, and remove the temporary debug/restore commits before merging.

[claude]

The CHANGELOG entry documents a security fix to ai-claude-review.yml (reading review instructions from the base ref via a second sparse checkout into .review-base/), but that fix is not actually in this PR. The net diff against main is only the CHANGELOG entry — the workflow file at the head SHA is identical to main because the fix commit was reverted by 2b957b1 ("temporarily restore main workflow to isolate regression").

Merging as-is would claim the vulnerability is fixed while leaving it unfixed, and would carry temporary debug/restore commits into history. Please re-apply the actual workflow change (or drop the CHANGELOG entry) so code and changelog agree, and clean up the temporary commits.